CVEvulnerability

CVE-2026-82861

8.7 HIGH Published 2026-08-31 Modified 2026-10-08 Official page ↗

Status: Deferred
Published: 2026-08-31
Last modified: 2026-10-08
Assigner: [email protected]
CVSS 4.0 ([email protected]): 8.7 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected]): 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses: CWE-284

Description

@hulumi/policies versions before 1.3.2 contain a parent spoof bypass vulnerability that allows attackers to submit spoofed SecureBucket parent evidence during policy evaluation. Attackers can bypass security policy checks by providing falsified evidence, causing the validator to miss unsafe bucket configurations.

Weakness · CWE (1)

CWE-284 Improper Access Control weakness

References

https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-g43v-9x7q-83pq github.com
https://www.vulncheck.com/advisories/hulumi-policies-before-1.3.2-securebucket-parent-spoof-bypass www.vulncheck.com

CVE-2026-82861

Description

Related

Weakness · CWE (1)

References